Data::SortedSet::Shared versions prior to 0.03 create a memory‑mapped segment backed by a file opened with mode 0666. This introduces two weaknesses: improper handling of absolute paths and directory traversal (CWE‑59) due to the lack of O_NOFOLLOW and potential symlink traversal, and incorrect permission assignment (CWE‑732) because the file is created with mode 0666 which, with a default umask of 022, results in a world‑readable file. A local attacker can either use a pre‑existing regular file or forge a symlink at the expected path to gain read access or to perform a race condition that redirects the open. The outcome is that any local user can read IPC data or influence which file is used, potentially exposing sensitive data or compromising the integrity of the shared data. The primary impact is therefore confidentiality loss for local users interacting with shared Data::SortedSet::Shared instances.

The vulnerability affects Perl modules distributed by the EGOR vendor under the Data::SortedSet::Shared package. Versions before 0.03 are affected. Practically any installation that places the shared segment in a directory such as /tmp or /dev/shm, which are commonly world‑accessible, is at risk. Systems using Perl and consuming the module without upgrading will be impacted.

The CVSS score is 3.8, indicating a moderate severity. The EPSS score of less than 1% suggests that, at present, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access; an attacker must have the ability to write to the path where the backing file is created, or to create a symlink there, and then run a process that loads the vulnerable module. Once the conditions are satisfied, the attacker can read the content of the mmap segment or redirect the path during the open, achieving information disclosure and potentially tampering with the data structure.